Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2026-27501

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27573

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27580

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27581

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27582

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27583

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27707

Publication date:

27/02/2026

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a new Seerr account on any Plex-configured instance by authenticating with an attacker-controlled Jellyfin server. The attacker receives an authenticated session and can immediately use the application with default permissions, including the ability to submit media requests to Radarr/Sonarr. Any Seerr deployment where all three of the following are true may be vulnerable: `settings.main.mediaServerType` is set to `PLEX` (the most common deployment).; `settings.jellyfin.ip` is set to `""` (default, meaning Jellyfin was never configured); and `settings.main.newPlexLogin` is set to `true` (default). Jellyfin-configured and Emby-configured deployments are not affected. Version 3.1.0 of Seerr fixes this issue.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-27734

Publication date:

27/02/2026

Beszel is a server monitoring platform. Prior to version 0.18.2, the hub&#39;s authenticated API endpoints GET /api/beszel/containers/logs and GET /api/beszel/containers/info pass the user-supplied "container" query parameter to the agent without validation. The agent constructs Docker Engine API URLs using fmt.Sprintf with the raw value instead of url.PathEscape(). Since Go&#39;s http.Client does not sanitize `../` sequences from URL paths sent over unix sockets, an authenticated user (including readonly role) can traverse to arbitrary Docker API endpoints on agent hosts, exposing sensitive infrastructure details. Version 0.18.4 fixes the issue.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-26997

Publication date:

27/02/2026

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, a normal authenticated user can store the XSS payload. The payload is triggered by administrator. Version 5.5.3 #59 fixes the issue.

Severity CVSS v4.0: LOW

Last modification:

27/02/2026

CVE-2026-27200

Publication date:

27/02/2026

Rejected reason: Further research determined the situation described is not a vulnerability.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026

CVE-2026-22717

Publication date:

27/02/2026

Out-of-bound read vulnerability in VMware Workstation 25H1 and below on any platform allows an actor with non-administrative privileges on a guest VM to obtain limited information disclosure from the machine where VMware Workstation is installed.

Severity CVSS v4.0: Pending analysis

Last modification:

27/02/2026